CVE Vulnerability Catalog

Improper privilege management vulnerability in Horizon Security Analyzer (formerly AlgoSec Firewall Analyzer) on Linux 64-bit allows privilege escalation and parameter injection. A local user with command line access may escalate privileges by abusing parameters of a command approved in the sudoers file. Affects versions A33.10, A33.20, and A33.30.

The API is prone to XML external entity (XXE) injection. By default, XML external entity support is enabled. This affects NanoXML version 2.2.3.

The EDD Product Catalog Feed by PixelYourSite plugin for WordPress is vulnerable to unauthorized data modification leading to denial of service due to a missing capability check in the wpeddpcf_delete_feed function. Authenticated attackers with subscriber-level access can delete arbitrary option values.

In Eclipse Che versions 7.79.0 through 7.121.0, the dashboard backend's POST /dashboard/api/data/resolver endpoint passes a caller-supplied URL directly to an outbound HTTP GET request with no host filtering. An authenticated user can exploit this SSRF to read responses from internal network addresses, including cloud instance metadata service (169.254.169.254), loopback interfaces, RFC-1918 private ranges, and in-cluster Kubernetes services. The operator-configured allowlist is not consulted. Fixed in version 7.122.0, which adds private-address blocking, IPv4-mapped IPv6 bypass prevention, operator allowlist enforcement, and disables HTTP redirects on the outbound request.

Backend administrators without system maintainer privileges can schedule configuration:read, configuration:set, and configuration:show commands. This allows them to modify system configuration, potentially gaining system maintainer privileges or causing denial of service.

Several AJAX routes used for the backend localization wizard failed to perform authorization checks. This allowed authenticated, low-privileged backend users to access information about records and content elements outside their permitted range. Exploitation requires a low-privileged backend user account. Affects TYPO3 CMS versions 10.0.0-10.4.59, 11.0.0-11.5.53, 12.0.0-12.4.48, 13.0.0-13.4.34, and 14.0.0-14.3.6.

Insertion of sensitive information into log files in the Snowflake Python, Go, JDBC, Node.js, PHP PDO, and ODBC drivers allowed authentication tokens, query-result encryption keys, pre-signed cloud-storage URLs, and SAML assertions to be written to diagnostic logs where log redaction did not cover all affected paths and data types. An attacker with read access to the log destination could obtain credentials and decryption keys that, if still valid, could be used to authenticate to the corresponding Snowflake account or cloud-storage object. Fixes are available in specific driver versions and require manual upgrade.

NuBrowser lacks protocol whitelist validation for the S.browser_fallback_url field of intent://, allowing attackers to inject javascript: URLs via 302 redirects. This results in a universal cross-site scripting (UXSS) vulnerability that enables script execution within the origin of arbitrary websites.

The shell theme installer in gnome-tweaks extracts user-supplied ZIP archives without validating archive member paths. As a result, a crafted theme archive can write files outside ~/.themes by using ../ path traversal, absolute paths, or symlink entries.

Command argument injection vulnerability in Cosminexus Component Container. Allows an attacker to execute unauthorized system commands.

OS command injection vulnerability in Cosminexus Component Container. Allows an attacker to execute arbitrary commands on the server.

SIMOVE Fleetmanager and SIPLANT devices do not properly validate and neutralize directory traversal sequences in the file-serving endpoint of the embedded HTTP server. An unauthenticated remote attacker can read arbitrary files from the operating system, including credentials and private keys.

A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). A special maintenance mode can be activated via a physical key sequence during device boot, in which the device downloads and executes program code from a network server without verifying its authenticity or integrity. This could allow an attacker with physical access to the device to upload and execute arbitrary, unsigned code.

A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). The input received over a proprietary communication protocol that is exposed when the device is placed into a special firmware-update mode is not properly validated, resulting in a memory corruption condition. This could allow an unauthenticated attacker with physical access to the device to cause a crash and potentially execute arbitrary code on the device.

A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). The device firmware contains binaries from which debugging symbols have not been removed. This could allow an unauthenticated attacker with access to the publicly available firmware update files to more easily reverse engineer the device's firmware, facilitating the identification of further vulnerabilities.

Reyrolle 7SR5 devices do not properly enforce server-side authorization checks in the web-based management interface. Manipulation of request data can bypass RBAC restrictions, allowing an authenticated low-privileged attacker to escalate to administrative level.

The web server in Reyrolle 7SR5 devices does not properly limit or manage system resources when processing a high volume of concurrent HTTP requests. An unauthenticated remote attacker can cause the device to crash and reboot, resulting in denial of service.

In Reyrolle 7SR5 devices, the length of the URL component in pre-authenticated HTTP messages is not properly validated before appending additional data, resulting in an out-of-bounds write. An unauthenticated remote attacker can crash the device, causing a reboot and denial of service.

In Reyrolle 7SR5 devices, a random number generator used for security-relevant values (such as session identifiers) is not initialized with a True Random Number Generator (TRNG), resulting in predictable sequences. An unauthenticated remote attacker can more easily predict values and impersonate a legitimate user.

In Reyrolle 7SR5 devices, session identifiers are generated using an algorithm with insufficient randomness, resulting in low-entropy tokens that can be predicted or brute-forced. An unauthenticated remote attacker can derive valid session identifiers and bypass authentication.